[SizzleUnrlsd]

Summary

Multi-file analysis (§21 Multi-File Analysis of docs/architecture.md): --check now accepts a directory.

• Acceptance tests first (test: define multi-file analysis behavior), implementation follows.
• interprocedural/modulegraph.py: discovery of the Python files under a root (hidden and tooling directories skipped), dotted module names from packages (app/__init__.py is app), and a ModuleGraph of the imports between project modules, taken from the import statements and the symbols they bind.
• SummaryIndex and the ProjectSummaries input analysis: functions defined in the project get project symbols (python.app.helpers.execute); the engine provides the index of their summaries to every module's manager. Alone, a module sees an empty index, which is the single-file behaviour.
• SummaryAnalysis and TaintAnalysis consult the index when a call resolves to a project symbol, so a tainted argument passed to a helper defined in another file is a flow at the call site (through app.helpers.execute), and a helper returning attacker-controlled data taints its result across files.
• engine.analyze_project iterates summaries to a fixpoint across modules. Each round re-provides the index and runs a TransformationPass that invalidates only the results depending on it, the first real use of the manager's invalidation (§12). Syntax errors and unsupported functions are reported per file as notes.
• Package inits are named after their package and their relative imports resolve against the package itself, lifting an earlier limitation.
• CLI: --check DIR; --emit-ir still needs a file.

Not in this PR: heap and aliasing (last bullet of #27), methods called through instances across modules (needs type inference), and analysing files outside the given root.

Closes #27 except the heap and aliasing bullet, which moves to its own issue.